Binance CFO departs one week after $6B hack

North Korean-linked hackers have been moving stolen Binance assets through new, fake cryptocurrency tokens, according to blockchain analytics firm Elliptic. The group created six meme tokens between November 5th and 7th, moving about 117,000 NEAR tokens, worth approximately $430,000, during this period. Elliptic detected the illicit activity while tracing funds from the $6.43 billion Binance heist that took place on October 29th.

Rather than directly transferring stolen cryptocurrency, the hackers exchanged the stolen NEAR for these self-created tokens and then sold them back into the same pools using different wallets. This made the transactions appear as ordinary market activity, complicating efforts to trace the illicit funds. The FBI attributed the Binance theft to North Korea’s TraderTraitor operation on October 31st, warning crypto businesses, blockchain operators, and investigators to block transactions linked to identified attacker addresses.

Elliptic identified six NEAR-based tokens (FUK, OLCCL, MEILI, MMLI, DABI, and SINU) paired with NEAR in separate decentralized exchange liquidity pools. Each token's creation cost around $90, making it inexpensive to deploy repeatedly. The laundering scheme was observed to have intricate trading patterns, with most transactions occurring within a single day.

By November 8th, all six tokens had ceased trading. The creators of four tokens withdrew remaining liquidity from their pools that afternoon, converting the NEAR into stablecoins or transferring it to cross-chain bridges. While the software used to create the tokens, the exchange, and the wallet application were not directly involved in wrongdoing, Elliptic emphasized that they exploited standard functions available to ordinary users of decentralized financial services.

The North Korean hackers were not alone in their methods, as Elliptic also detected similar token-based laundering techniques on the Tron blockchain and Solana, without relying on newly created tokens. By November 9th, over 20,000 wallets across 16 blockchains and 65,000 transactions had been involved in the Binance laundering operation, with approximately $3 billion remaining in associated addresses.

About 11.8 million stolen NEAR, valued at $43.7 million, had not moved, prompting Elliptic to advise compliance teams to scrutinize the origins of assets entering liquidity pools.